Скачать или смотреть Android Application Pinning Bypass | Pinned @ HackTheBox

Pinned is an easy difficulty Android mobile challenge from ‪@HackTheBox‬. In this video we bypass the certificate pinning mechanism implemented by the app in order to intercept application’s requests and obtain the secret flag.

=== Timestamp ===
00:00 - Intro
01:19 - What is a certificate and how it works
02:21 - Introduction to certificate validation
03:49 - Importing a certificates in a browser
04:24 - Importing a certificate into an Android device
05:42 - Installation and execution of the APK
06:12 - Setting up the device to intercept HTTP requests
06:39 - Certificate pinning prevents intercepting HTTP requests
06:55 - Code decompilation and analysis
07:58 - Identification of the original certificate
08:28 - High level analysis of the certificate pinning implementation
09:05 - Introduction to Frida, Xposed and its modules
09:45 - Frida installation
10:25 - Testing Frida
11:05 - Defeating certificate pinning using Frida
11:54 - Testing SSLUnpinning and TrustMeAlready
12:40 - Conclusion


If you enjoyed the video leave a like and subscribe to my channel!
For writeups in text format or other articles related to Ethical Hacking go to my blog: https://maoutis.github.io/
---
Would you like to support my work? Offer me a virtual coffee :)
https://www.buymeacoffee.com/0xbro

Check out my socials:
Twitter:   / 0xbro1  
Linkedin:   / mattia-0xbro-brollo-b4129614b  

External resources:
https://protonmail.com/blog/tls-ssl-c...
https://www.digicert.com/how-tls-ssl-...
https://httptoolkit.tech/blog/interce...
https://docs.broadcom.com/doc/certifi...
https://scotthelme.co.uk/cross-signin...
https://www.venafi.com/blog/how-does-...
https://docs.oracle.com/javase/7/docs...
https://docs.oracle.com/javase/7/docs...
https://docs.oracle.com/javase/7/docs...
https://docs.oracle.com/javase/7/docs...

Tags:
#CertificatePinning #HackTheBox #AndroidHacking #Pinned #Frida #SSLUnpinning #TrustMeAlready #Xposed #AndroidCTF